One nasty trick was to abuse CallWindowProc to call arbitrary code by passing it a pointer. This technically violates this functional contract, since it should only be used with handles (and not with direct code pointers) received through GetWindowLong ; but in practice, so few people actually know this, that the implementation is forced to allow arbitrary code pointers. This allows you to call any function pointer if it is stdcall , and accepts 4 arguments of the same size as the WndProc arguments.
One even more unpleasant trick, which is a consequence of the above, is that you can dynamically generate code this way - just insert it into the byte array and use CallWindowProc to go to it. This way you can embed your own code without VB6 in a VB6 application without any external DLLs. Of course, at this age, the NX bit is turned on by default, probably this is not such a good idea (if it ever was, that is) ...
source share